6
\$\begingroup\$

I am storing a password in a database (school coursework so nothing too complicated but I want to challenge myself), I am using a one way hash function, is this suitable? It works I just feel there may be nicer ways of storing the password. The database is SQL, language is C#

static class Encryption
{
    public static string OneWayEncrpyt(string toEncrypt)
    {
        byte[] data = System.Text.Encoding.ASCII.GetBytes("password");
        data = new System.Security.Cryptography.SHA256Managed().ComputeHash(data);
        return System.Text.Encoding.ASCII.GetString(data);
    }
}
\$\endgroup\$
7
\$\begingroup\$

No, it isnt.

First, you only allow ASCII characters in the password. If I were to choose €¥≠≥≤©® as my password, it would probably be equivalent to choosing ??????? (7 question marks). Try it.

Second, a password hashing function must be slow. Otherwise it is too easy to crack the password.

Third, when you hash a password, you must add some salt to it. This has the effect that even when two people use the same password, the hashed passwords are different, so a possible attacker cannot group people by their passwords.

Fourth, if you print the hashed password and it contains lots of question marks, you are doing it wrong. Instead of converting the hash bytes directly to a string, you must encode them so that only printable characters remain. Typical choices for such an encoding are base64 and hex.

In every possible scenario, even in school, you should use an established algorithm like bcrypt or scrypt instead of inventing your own.

\$\endgroup\$
  • \$\begingroup\$ Ah ok, I have a lot of validation using REGEX, not shown cause it's held in custom controls elsewhere.. I have it validated I should edit to say that! How do I make it slow and how do I add salt can I get some explanation please? Thanks \$\endgroup\$ – Daniel Loudon Oct 12 '17 at 22:22
  • 4
    \$\begingroup\$ There are already enough explanations on the internet. I gave you the relevant keywords, the rest is up to you. :) \$\endgroup\$ – Roland Illig Oct 12 '17 at 22:26
  • \$\begingroup\$ Yes I have googled bcrypt, and found what a salt was. Thanks for the direction \$\endgroup\$ – Daniel Loudon Oct 12 '17 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.